[finding] The half-state patrol's anchor is not exempt from the stale bot — it survives only while the patrol is alive, so a dead patrol has its own gravestone auto-closed

[os-steve]

Observation-level, unassigned, filed from the #14881 measurement flight (the hotcrm patrol install). ⛔ Not the subject of that card. Fleet-wide, and it is this repo's own anchor #9857 too — not a hotcrm-only hazard.

The measurement

.github/workflows/stale.yml in this repo:

days-before-issue-stale: 60
days-before-issue-close: 14
stale-issue-label: 'stale'
exempt-issue-labels: 'pinned,security,roadmap'
remove-stale-when-updated: true

The patrol anchor #9857 carries exactly one label, tracking, and no assignee. tracking is not in that exempt list. The anchor is therefore protected by nothing but its own updated_at, which the patrol refreshes four times a day when it PATCHes the body.

That protection is exactly co-extensive with the patrol being alive — which inverts it. half-state-patrol.yml's header states the property the anchor exists to carry:

The Swept timestamp in that body is the patrol's heartbeat and is deliberately refreshed even when the findings are unchanged: a timestamp that stops advancing is how a reader learns the standing caller died.

So: patrol dies, the heartbeat stops, updated_at freezes — and 60 days later the stale bot labels the gravestone stale, then closes it 14 days after that. The one artifact whose job is to make the death visible is removed because of the death. And remove-stale-when-updated: true means a patrol that recovers silently clears the stale label, so the near-miss leaves no trace either.

The sweeper keeps writing into a closed issue afterwards — issues.update succeeds on a closed issue — which is the "runs, finds, and tells nobody" shape the same header calls out by name.

Severity, stated honestly

It needs the patrol dead ~74 days first, and a patrol that cannot run fails its job red on every scheduled fire, so this is a second-order failure behind a loud first-order one, not a live defect today. What makes it worth a row anyway is the direction: it degrades the alarm precisely in the scenario the alarm is for, and the repair is one word in a list.

It is tighter in the repos being onboarded

hotcrm (clone at 18444c8, .github/workflows/stale.yml) runs the same action with days-before-issue-close: 7 and exempt-issue-labels: 'pinned,security,bug,enhancement' — also no tracking. Whatever is decided here should be decided for the install recipe #14881 hands the repo:hotcrm seat, or every adopter inherits it.

What would close it

Add tracking to exempt-issue-labels in stale.yml (and mirror it in each adopter's copy), or give the anchor a label already in the list. ⛔ Not fixed in #14881's PR: stale.yml is outside that card's declared file surface, and this deserves its own judgement rather than a rider.

Generated by Claude Code

[claude]

Triage — skills seat (session session_019RfFHiRCSs3JXLK4cwcfox, os-steve), 2026-09-03T17:12Z. Graded priority:p3 (the window is 60 + 14 days; nothing is at risk this month), finding cleared, domain:skills kept (the patrol and its anchor are this lane's tooling), tooling, state pm:queue, type Task. Applied and read back after this comment.

Scope as queued (XS, .github/workflows/stale.yml only): add the anchor's label to exempt-issue-labels so the gravestone outlives a dead patrol, with the reason recorded in the file. The hotcrm copy is the seam card's business, not this card's. ⛔ No change to the patrol workflow or the sweeper.

---

Generated by Claude Code

[os-steve]

Claim: PM loop round 2
Session: session_019RfFHiRCSs3JXLK4cwcfox
Branch: claude/issue-15002-stale-exempt-anchor
Worktree: objectstack-issue-15002
Domain: domain:skills
File surface: .github/workflows/stale.yml (the exempt-issue-labels value at :48 at origin/main 33681eae, plus one comment line above it) (stop on breach; explain in the report). ⛔ Not exempt-pr-labels, not the patrol workflow, not the anchor issue.
Container & model: XS mechanical (one list value + one comment line in a workflow), mode:subagent, model: sonnet (tier: node scripts/pm/dispatch-gates.mjs --tier .github/workflows/stale.yml at origin/main 33681eae, 17:17Z: "no path-derived mandate … floor sonnet · default opus · ceiling fable"; PM's call: sonnet floor, the review runs at the contract tier in-seat)
Clause-②: no
Serial constraints cleared: .github/workflows/stale.yml is free on the seat post's hot-file queue; no in-flight claim names it; no open PR touches it (last merge 736980c9 08-31). Not a governed surface (check-governed-merges --test: 0 of 1 hit), no .md ⇒ pure-code landing: in-seat review → ready → auto-merge.

Decision re-read (17:17Z): no maintainer ruling; triaged by this seat 17:12Z (comment 5529324386) with the scope "add the anchor's label to exempt-issue-labels so the gravestone outlives a dead patrol, with the reason recorded in the file". Of the finding's two remedies, exempting tracking is the one that keeps the anchor's single-label shape the sweeper and the adopt recipe both depend on; giving the anchor pinned would be a second label with a second meaning. The hotcrm copy's stale workflow is the seam card's business (#15009), not this card's.

---

Generated by Claude Code